CVE-2025-38071: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel will crash and burn because memblock_phys_alloc_range() returns 0 on failure, which leads memblock_phys_free() to throw the first 4 MiB of physical memory to the wolves. At a minimum it should fail gracefully with a meaningful diagnostic, but in fact everything seems to work fine without the weird reserve allocation.

Affected products

• Debian Debian Linux: version 11.0 only
• Linux Linux Kernel: before 6.1.141 (fixed in 6.1.141); from 6.2, before 6.6.93 (fixed in 6.6.93); from 6.7, before 6.12.31 (fixed in 6.12.31); from 6.13, before 6.14.9 (fixed in 6.14.9)

Published 2025-06-18. Last modified 2026-06-17.